CVE-2026-89116: OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code
The affected code used childprocess.execSync with a shell string for generator installation and uninstallation. This allowed an attacker to execute arbitrary OS commands with the developer's privileges by manipulating the ApplicationWizard.installationLocation VS Code workspace configuration value. Because the value was passed directly to the shell without sanitisation, a malicious workspace repository could craft a settings.json that injects OS commands when a developer opens the project and triggers a generator installation.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Developers using the Yeoman-UI Application Wizard Extension for VS Code are exposed if they open a workspace whose configuration controls ApplicationWizard.installationLocation and then trigger generator installation or uninstallation. The injected command runs with that developer's OS privileges.
What does an attacker need to exploit this issue?
An attacker needs to induce a developer to use a malicious workspace repository containing a crafted settings.json value for ApplicationWizard.installationLocation. Exploitation also requires the developer to trigger generator installation or uninstallation; no additional user interaction is described.
How can I tell whether a workspace may be affected?
Inspect workspace settings.json files for the ApplicationWizard.installationLocation setting, particularly in untrusted or third-party repositories. Treat values containing shell metacharacters or unexpected command content as suspicious, since this value was passed directly to a shell command.
What can be done before patching?
Avoid opening untrusted workspaces with the extension enabled, and do not trigger generator installation or uninstallation in repositories you have not reviewed. Review or remove ApplicationWizard.installationLocation values from workspace settings before using the generator functionality.